I'm trying to restrict a user to a specific directory called gclegal using a chroot jail. I've uncommented the line in the /etc/vsftpd.conf file


Created a new user called kg:

$ sudo groupadd xenomai
$ sudo useradd -d /var/www/html/gclegal -g xenomai kg
$ sudo passwd kg 

With this configuration I'm able to login through vsftpd with kg user but I'm also able to browse back to parent directories and modify them until /var/www/html.

How can I disable all operations outside the home of the user (/var/www/html/gclegal)?

2 Answers 2


Working from the vsftpd version 2.2.2, there are two options for keeping users in a chroot jail:

  • chroot_list_enable

Just add users to the chroot list e.g. (/etc/vsftpd/chroot_list) that you want placing in a chroot jail.

  • chroot_local_user

This will place all local users in a chroot jail, however, if this is set then the chroot_list becomes a list of users who DO NOT go in a chroot jail.

Therefore check your list does not contain user kg if you have chroot_local_user=YES configured.

Obviously restart the vsftpd daemon after making configuration changes.

Excert from man vsftpd.conf

          If activated, you may provide a list of local users who are placed in a chroot() jail  in  their  home  directory  upon  login.  The  meaning  is  slightly  different  if
          chroot_local_user  is set to YES. In this case, the list becomes a list of users which are NOT to be placed in a chroot() jail.  By default, the file containing this list
          is /etc/vsftpd/chroot_list, but you may override this with the chroot_list_file setting.

          Default: NO

          If set to YES, local users will be (by default) placed in a chroot() jail in their home directory after login.  Warning: This option has security implications, especially
          if  the  users  have  upload permission, or shell access. Only enable if you know what you are doing.  Note that these security implications are not vsftpd specific. They
          apply to all FTP daemons which offer to put local users in chroot() jails.

          Default: NO

I have configured vsftpd to chroot users and these are the /etc/vsftpd.conf settings that I used (Ubuntu 14.04):


NOTE: Ensure /etc/vsftpd.chroot_list or /etc/vsftpd/chroot_list are empty.

Once you get it working, if you want to keep track of ftp logins, then you can set session_support=YES and these should then apprear using the last command:

username   vsftpd:12025 IP address     Tue Oct 14 14:05 - 14:10  (00:05)
username   vsftpd:12011 IP address     Tue Oct 14 14:04 - 14:05  (00:00)

NOTE - utmp and wtmp support is only provided with PAM enabled builds.

  • Thanks, vsftpd -v vsftpd: version 3.0.2 I've just the chroot_list_enable=YES. I've created the file in /etc/vsftpd/chroot.list and added the kg user. I'm still able to browse back and modify the html folder.
    – UserK
    Oct 14, 2014 at 15:30
  • @narutov6 - To confirm, if you have chroot_list_enable=YES, then the list should contain users who you do NOT want chrooting. Why dont you try setting chroot_list_enable=YES, chroot_list_file=/etc/vsftpd/chroot_list, chroot_list_enable=NO and keep kg in your chroot_list, restart vsftpd and check again. P.S. What OS are you running? Oct 14, 2014 at 15:36
  • Same behavior with chroot_list_file=/etc/vsftpd/chroot_list and corresponding file set up. I've tried with chroot_list_enable=YES chroot_list_enable=NO. I'm using Ubuntu 14.04.
    – UserK
    Oct 14, 2014 at 15:49
  • @narutov6 - I have just got this working on Ubuntu 14.04 using your user settings and directories and updated the Answer with my settings. I had to add the allow_writeable_chroot setting to disable the latest security feature. Oct 14, 2014 at 16:21
  • I have your same config file. If I connect with kg user with filezilla, the /var/www/html/gclegal folder is opened but I am able to browse back to /var/www/html and transfer file to it...same problem as before.
    – UserK
    Oct 15, 2014 at 14:46

I set selinux to permissive and restarted vsftpd.service, which fixed the problem.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .